II. AMENDMENTS TO THE SPECIFICATION 

Please accept amendments to the paragraph beginning on p. 19 of the 
specification as follows: 

Fig. 5 depicts a fourth page 130 of the template that includes purpose section 132, and 
control point procedure section 134. Purpose section 132 allows the control point author to state 
the identified risk or control point. For example, purpose field 132 might indicate, "individuals 
approving payments are signing checks." Control point procedure section 134 includes 
information access field 136 and control point process field 138. Information access field 136 
indicates where information pertinent to the control point can be obtained. For example, 
information access field 136 could indicate where the employee identification numbers could be 
found. Preferably, information access field 136 includes a hypertext lirLk(s) that allows direct 
access to pertinent information. Control point process field 138 includes a test field 140 for 
arranging the set of tests to be performed on the business process for identifying risks. For 
example, test field 140 could indicate the tests: (1) compare identification number of individual 
approving payment to identification number of individual signing the check; and (2) compare 
name of individual approving payment to name of individual signing the check. As stat e stated 
above, the set of tests could include one or more tests. Accordingly, test field 140 allows for 
many tests to be indicated. Test execution field 142 is for arranging the test entity responsible 
for carrying out the indicated set of tests. This could be indicated based on particular 
individuals, management levels, etc. As indicated above, the test entity can be one individual, a 
group of individuals, or an expert system. Moreover, one test entity need not be responsible for 
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carrying out the entire set of tests. For example, each test in the set could have a different 
executing entity. 
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